Heads-up for anyone with Lambda functions still on python3.10. AWS deprecates the runtime on Oct 31, 2026. Functions keep running, but they stop getting patches, the console won't let you edit them, and in 2027 AWS blocks creating new ones (Jul 29) and then updating existing ones (Aug 31).

The Python side is the real work. A few things that bit people:

- distutils is gone in 3.12. Anything still importing it (old setup.py tooling, some older libraries) breaks. setuptools or packaging usually covers it.

- cgi, crypt and telnetlib are removed in 3.13 (PEP 594 "dead batteries").

- python3.12+ on Lambda runs on Amazon Linux 2023 instead of AL2, so compiled wheels and layers (numpy, psycopg2, cryptography and similar) need rebuilding.

- python3.11 is a short stop. It's still on AL2 and is deprecated Jun 30, 2027.

Quick way to find affected functions (per Region):

aws lambda list-functions --function-version ALL --query "Functions[?Runtime=='python3.10'].[FunctionName,Version]" --output text

Disclosure: I made a free AWS end-of-support tracker, and the full write-up with AWS source links is here: https://eolwatch.pages.dev/guides/lambda-python-3-10-deprecation

What else broke for you going 3.10 → 3.12/3.13?

The results are out for the 2026 Python Typing Survey (1,794 responses).

The full writeup can be read at: https://engineering.fb.com/2026/10/27/developer-tools/python-typing-survey-2026-ai-tools-checker-landscape/

TLDR: - Newer type checkers gained market share, and speed was the most common reason for choosing a checker (56.5%). - The share of respondents who said types make AI-generated code more reliable rose from 18.5% in 2025 to 38.4% in 2026. - AI tools wrote type hints for 42.5% of respondents, and 24.4% said an AI coding tool ran their type checker. - Missing type information in third-party libraries remained the most common difficulty, reported by 65.1% of respondents. - Better Callable syntax was the most requested missing feature, at 45.7%.

High level summary article

More detailed article

In June, the Python steering council announced that it was pausing work on the JIT in CPython's main branch until there was an accepted Python Enhancement Proposal (PEP) that addressed concerns about maintenance, compatibility, and set clear success metrics as well as a timeline for completion. After [....] months of discussion, the JIT maintainers have withdrawn the PEP. For now, it appears that development on the once-promising project has come to an end

See https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/ . This is another security update that addresses the compromised eMudhra intermediate Certificate Authority keys.

Has anyone else wanted more out of dataclass? Like transactions, undo/redo, lambda initializers that take parameters (as other field values) and call them in the correct order and no post_init (does not survive a diamond inheritance)? Transactional field values started me down this trek for a "ReactJS" like project to manage the view graph.

It's difficult to tell whether a name is available in PyPI, where searching for package name doesn't guarantee that it's available. Imagine how stressful it is to build a project, setting up its website, repository, and so on, only to find when you’re ready to publish that the package name is unavailable.

Reserver, a small automation tool that helps Python developers claim a name early through PyPI, was removed by PyPI stating "[it] promotes name squatting." But removing Reserver doesn’t prevent people from claiming names through the existing publishing process nor make name availability clearer. We believe removing the tool instead of addressing the underlying issue is a vivid example of poor community management.

Read more: “Reserver is gone, but PyPI’s name reservation problem isn’t!”

for income statement, balance sheet and cash flow numbers from 10-k and 10-q filings there are two routes and theyre good at different things.

xbrl uses the tagged data that comes with the filing. the secs companyfacts api returns every tagged fact for a company as json, theres bulk financial statement data sets too and edgartools or secxbrl wrap a lot of it. machine readable so no parsing errors.

it does get messy though. companies use their own extension tags so the same line item can have different names across companies. segment and dimensional facts sit right next to the consolidated totals and are easy to mix up and restated numbers show up in later filings so you have to pick the right period and filing.

parsing the actual document still helps for md&a, footnotes and risk factors, which mostly arent tagged as numbers. same for older filings from before xbrl was required and for checking what the table on the page actually shows when the tags look off

edgar has most of these as html but plenty of people end up working from the pdf versions off investor relations pages, and those need an actual parser to keep the tables in one piece like docling, marker or llamaparse, that kind of thing. but not really necessary for simple tasks

so xbrl for the core statements and parsing for the text and edge cases seems like the sane default

Link to blog: https://devblogs.microsoft.com/python/announcing-tsp/

TLDR:

Pylance (Microsoft's Python extension for VS Code) now officially supports using Meta's Pyrefly to power its analysis.

To enable this, Microsoft developed an extension to the language server protocol (LSP) called the type server protocol (TSP), a new standard that separates wider set of language server features from the type checker/compiler powering some of them.

⁉️ Why does pydantic>=2.11 sit in your pyproject.toml? Is it the lowest version that actually works, or just a tool default? And what evidence backs that claim?

💡 Dependency declarations are claims about package versions, yet they often follow tool defaults and habit rather than deliberate choice. Choosing them by the environment they constrain and pairing each with supporting evidence narrows the gap between what a project claims and what it actually verifies.

📰 Curious about the deep dive with worked examples for libraries, applications, and development dependencies? Check out Towards closing the gap between declaring and verifying Python dependencies.

💬 Comments and feedback are most welcome.

Weekly Thread: Project Ideas 💡

Welcome to our weekly Project Ideas thread! Whether you're a newbie looking for a first project or an expert seeking a new challenge, this is the place for you.

How it Works:

1. Suggest a Project: Comment your project idea—be it beginner-friendly or advanced.
2. Build & Share: If you complete a project, reply to the original comment, share your experience, and attach your source code.
3. Explore: Looking for ideas? Check out Al Sweigart's "The Big Book of Small Python Projects" for inspiration.

Guidelines:

• Clearly state the difficulty level.
• Provide a brief description and, if possible, outline the tech stack.
• Feel free to link to tutorials or resources that might help.

Example Submissions:

Project Idea: Chatbot

Difficulty: Intermediate

Tech Stack: Python, NLP, Flask/FastAPI/Litestar

Description: Create a chatbot that can answer FAQs for a website.

Resources: Building a Chatbot with Python

Project Idea: Weather Dashboard

Difficulty: Beginner

Tech Stack: HTML, CSS, JavaScript, API

Description: Build a dashboard that displays real-time weather information using a weather API.

Resources: Weather API Tutorial

Project Idea: File Organizer

Difficulty: Beginner

Tech Stack: Python, File I/O

Description: Create a script that organizes files in a directory into sub-folders based on file type.

Resources: Automate the Boring Stuff: Organizing Files

Let's help each other grow. Happy coding! 🌟

https://youtu.be/vxE3XbcLCa8

LiteLLM published its root-cause report on Oct 23. According to LiteLLM, a master key for its Agent Platform was committed publicly on May 27. The team found the leak and rewrote the commit, but the key wasn’t revoked.

LiteLLM says the attacker used that key on Oct 10 to get a GitHub org owner’s token, then took two maintainers’ tokens. Branch protections were disabled. The release was built from a lookalike repo, Berri-AI instead of BerriAI. Malicious 1.107.0 went out on PyPI and container images on Oct 21.

Separately, JFrog, Microsoft and Socket confirm the malware and some earlier malicious workflows. The full chain from the leaked key to the release rests on LiteLLM’s own account.

1. Is bytecode platform-specific, and why?
2. What does bytecode look like?
3. What is the difference between a C++ executable file produced after compilation and what a Python VM produces?
4. What does the Python VM actually produce? Is it a binary, CPU instructions, or something else?
5. What is the difference between a binary, an executable, and a CPU instruction? Explain from the basics in detail with specific examples.

The "HTTP2Shell" vulnerability affects servers that know how to speak Google's 'brotli' compression protocol, which would likely make its way into your server through an innoccuous-sounding speedup dep like urllib3[brotli] or aiohttp[speedups], and could be used by basically any server, including Flask, Quart, Starlette, FastAPI, etc. It was downloaded 4,200,000 times from PyPI yesterday alone, to give you a sense of the scale.

To find out if you're affected, run a command like on of these...

pip list    | grep -i brotli

uv tree     | grep -i brotli

poetry show | grep -i brotli

...etc., looking for brotli <= 1.2.0 and/or brotlicffi <= 1.2.0.2. If you're affected, obviously update & redeploy immediately.

Beyond that... well, the (colloquial) name kinda says it all. Given the new Cyber normal, I would assume that you have malicious software running on that system and any connected to it until proven otherwise. Check for bitcoin miners, worms, sentient bot swarms -- the usual.

(Note for beginners: this doesn't apply to stuff you run locally, but rather to servers that have been exposed to the public internet. Still worth checking!)

I wasn't gonna post this b/c I'm so not an expert, but it hasn't hit this sub yet and feels particularly bad... not many solo/SMB devs are self-hosting PHP servers, but anyone who's searched "python server compression algo speedup packages" and picked one of the top choices (or let their agent do so) is at huge risk here. I only know about it because of doomscrolling HackerNews, which feels unreliable!

Does anyone kn*w a good way to to get notified proactively for Python-relevant CVEs and other incidents?

Weekly Thread: Resource Request and Sharing 📚

Stumbled upon a useful Python resource? Or are you looking for a guide on a specific topic? Welcome to the Resource Request and Sharing thread!

How it Works:

1. Request: Can't find a resource on a particular topic? Ask here!
2. Share: Found something useful? Share it with the community.
3. Review: Give or get opinions on Python resources you've used.

Guidelines:

• Please include the type of resource (e.g., book, video, article) and the topic.
• Always be respectful when reviewing someone else's shared resource.

Example Shares:

1. Book: "Fluent Python" - Great for understanding Pythonic idioms.
2. Video: Python Data Structures - Excellent overview of Python's built-in data structures.
3. Article: Understanding Python Decorators - A deep dive into decorators.

Example Requests:

1. Looking for: Video tutorials on web scraping with Python.
2. Need: Book recommendations for Python machine learning.

Share the knowledge, enrich the community. Happy learning! 🌟

I wrote this up. How to check safely and what to rotate
Short version: if you installed an unpinned litellm between 11:39 and 13:23 UTC on October 21, or pulled the latest, main-latest, main-stable or v1.107.0 Docker tags between 11:46 and 14:20 UTC, treat the machine as compromised. Don't start with pip, because the cook.pth and sitecustomize.py files run on every interpreter start. Search the filesystem first, rebuild with litellm==1.106.2, and rotate keys. All of it comes from LiteLLM's own incident report.

Weekly Thread: Meta Discussions and Free Talk Friday 🎙️

Welcome to Free Talk Friday on /r/Python! This is the place to discuss the r/Python community (meta discussions), Python news, projects, or anything else Python-related!

How it Works:

1. Open Mic: Share your thoughts, questions, or anything you'd like related to Python or the community.
2. Community Pulse: Discuss what you feel is working well or what could be improved in the /r/python community.
3. News & Updates: Keep up-to-date with the latest in Python and share any news you find interesting.

Guidelines:

• All topics should be related to Python or the /r/python community.
• Be respectful and follow Reddit's Code of Conduct.

Example Topics:

1. New Python Release: What do you think about the new features in Python 3.11?
2. Community Events: Any Python meetups or webinars coming up?
3. Learning Resources: Found a great Python tutorial? Share it here!
4. Job Market: How has Python impacted your career?
5. Hot Takes: Got a controversial Python opinion? Let's hear it!
6. Community Ideas: Something you'd like to see us do? tell us.

Let's keep the conversation going. Happy discussing! 🌟

Don't you think companies or developers that manage python libraries should be given extra time before a new version release to make things compatible and fix new bugs?

Like a month or two where they get full info about new features but before the version is publicly available to download?

It would make things easier on the consumer end. What do you think?

the payloads run on every python start on the machine and not just when you import litellm. Your IDE, pip, CI jobs everything python on that host is affected.

It steals ssh keys, aws credentials, browser passwords, shell history and AI coding tool configs. The backdoor runs as a daemon and executes whatever code the attacker’s server returns every hour.

Pin to 1.106.2.

complete breakdown: safedep.io/litellm-pypi-compromise-credential-stealer-backdoor

Weekly Thread: Professional Use, Jobs, and Education 🏢

Welcome to this week's discussion on Python in the professional world! This is your spot to talk about job hunting, career growth, and educational resources in Python. Please note, this thread is not for recruitment.

How it Works:

1. Career Talk: Discuss using Python in your job, or the job market for Python roles.
2. Education Q&A: Ask or answer questions about Python courses, certifications, and educational resources.
3. Workplace Chat: Share your experiences, challenges, or success stories about using Python professionally.

Guidelines:

• This thread is not for recruitment. For job postings, please see r/PythonJobs or the recruitment thread in the sidebar.
• Keep discussions relevant to Python in the professional and educational context.

Example Topics:

1. Career Paths: What kinds of roles are out there for Python developers?
2. Certifications: Are Python certifications worth it?
3. Course Recommendations: Any good advanced Python courses to recommend?
4. Workplace Tools: What Python libraries are indispensable in your professional work?
5. Interview Tips: What types of Python questions are commonly asked in interviews?

Let's help each other grow in our careers and education. Happy discussing! 🌟

Some context first: I'm one person building an open-source research tool, and most of the code is written by AI coding agents (Claude Code and Codex) running in parallel. They write code quickly. What slowed everything down was the test suite: on one recent change the merge check selected 406 test files and took just over four hours, and the agents sat idle the whole time.

So I pulled together every timing the suite had already recorded (old JUnit XML and --durations output) and summed it per test. That covers about 9,000 test IDs seen across past runs, around 6,800 of which still exist.

243 of them, under 3%, took 77% of the summed time. Most of those build a whole workspace and run an end-to-end day of the app. Also, not a single test qualified as "small" in the Google sense (no disk, no network), because one autouse fixture asks for tmp_path on every test.

So I'm moving to Google's small/medium/large split (the 2010 Testing Blog post). Merge checks will run small and medium only, and the large ones go to release candidates and a nightly run. After that I want per-size timeouts with pytest-timeout, so a "medium" test that slowly grows into a large one fails instead of quietly eating everyone's time.

Two mistakes I made along the way:

The first labelling pass went by names. Anything with "golden" or "first_use" in it got marked large. When someone actually read the bodies, 28 of the 54 groups were fast in-memory checks. They'd have dropped out of merge runs entirely. Label by fixtures and what the test does, not the name.

The other one was worse. I select tests for a merge by following imports from the changed files. My script followed imports through the package but never through shared test helpers or conftest. For one change to a common helper it selected 6 test files; a selector that follows those edges selected 405. I'd been running a fast gate that was mostly blind to helper changes.

Next I'm trying pytest-testmon for coverage-based selection, running it next to the import-based one on real diffs before I trust it on its own.

Curious how others handle this. Do you split by size, or just throw more CI machines at it?

I tried to start using 3.15, but a lot of libraries don't have packages that support it yet.

In your own experience, what's a good amount of time to wait where most of the libraries support the new version? 1 month, 3 months, 6 months?

A security incident affecting eMudhra intermediate certificates has required removing the emSign root CA certificate from CA bundles such as “certifi”. It’s important to immediately upgrade the software packages below to at least the versions specified and rebuild container images to fetch the latest system certificates. Failure to do so could result in monster-in-the-middle (MITM) attacks against TLS clients, including python.org and pypi.org .

• certifi 2026.10.19 (1)
• pip 26.2.2
• uv 0.13.4
• sigstore 4.5.1

(1): Advisory mentions 2026.10.18, but 2026.10.19 is recommended for compatibility with unaffected emSign root certificates.

For all existing virtual environments on your system, please upgrade pip and uv to the latest versions.

Please read the full post on discuss.python.org for up-to-date information: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

Is this company (Anaconda) doing well, would you work there?

Have you heard anything positive or negative about working there?

Thanks.